You ask ChatGPT "which sunscreen brand is best," and it confidently recommends a brand you've never heard of. You click through the search results and find several glowing reviews—all fake. This isn't hypothetical: it's the scenario exposed on China's CCTV 3.15 Gala (March 15, 2026), where commercial GEO (Generative Engine Optimization) operators demonstrated they can push fake brands to the top of mainstream AI assistants' recommendations within hours by seeding fake reviews online.
The question is: how easy is this really? Is one fake webpage enough?
A multi-institution research team built FORGE (Fake Online Recommendation Generation Evaluation), a benchmark with a disturbing answer: a single fake webpage ranking first can fool recommendations 27% of the time on the most vulnerable models. Even more surprising—the "smarter" the model, the easier it is to fool.
What Is an Adversarial Recommendation Attack?
Imagine buying a phone online. The normal flow: a search engine returns a set of webpages, an AI assistant reads them, and recommends products. The attacker's move is simple—inject one carefully forged webpage into those search results praising a fake brand.
This differs from traditional "training data poisoning," which requires access to the model's training pipeline. Web pollution only requires posting content online—anyone who knows SEO can do it. It also differs from "prompt injection," because the attacker never touches your conversation; they only pollute search results.
The FORGE benchmark covers 6 product categories (smartphones, dining, skincare, etc.) and tests 12 mainstream models, including closed-source models like GPT-5.4, Claude Opus 4.7, and Gemini 3.1 Pro, plus open-source models like Llama and Qwen.
Five Counterintuitive Findings
1. Large models are not safer than small ones. Closed-source commercial models show overall susceptibility no lower than open-source models. GPT-5.4 and Claude Opus 4.7 are more vulnerable than 7B open-source models in some categories.
2. Reasoning capability becomes a weakness. When "deep thinking" mode is enabled, susceptibility increases. The reason is subtle: reasoning makes the model "read" search results more deeply, and most of that deeper reading is shallow—model sees fake brand, adopts it. Only rarely does the model actually scrutinize evidence reliability. Researchers found that models that successfully resist attacks have reasoning chains 6x longer than fooled models—they didn't "fail to see" the fake brand; they saw it, thought carefully, and rejected it.
3. Fooled models fabricate their own social proof. This is the most chilling finding. After recommending a fake brand, the model doesn't just say "Brand X is good"—it invents nonexistent social proof like "many users report Brand X works well" and "Brand X ranks highly in multiple evaluations." The model is covering for itself: first persuaded by fake evidence, then actively generating more fake evidence to support its recommendation.
4. Skepticism prompts backfire. Researchers tried telling models in the system prompt to "be wary of unfamiliar brands." The result: closed-source models' susceptibility *increased* by 24 percentage points. Gemini 3.1 Pro's rate surged 44 percentage points. Like reasoning, skepticism prompts push models to examine evidence more deeply—but in most cases, that examination makes them *more* convinced by fake evidence.
5. Vulnerability is predictable. If multiple models highly agree on brand recommendations for a category without search results (e.g., dining, where everyone recommends the same famous brands), that category is hard to attack. Conversely, if models already disagree widely (e.g., smartphones), the category is especially vulnerable. Cross-model brand agreement correlates with susceptibility at r = -0.65.
Defenses: No Silver Bullet
Researchers tested three defense strategies:
1. Skepticism prompts: proven counterproductive. 2. Model prior-consensus filtering: only recommend brands the model would recommend without search results. This works, but at the cost of killing the ability to recommend new brands—you can only ever recommend brands that are "already famous." 3. Cross-document evidence consistency filtering: only recommend brands mentioned in multiple search results. This also reduces susceptibility, but drastically shrinks recommendation coverage.
The core dilemma: a recommendation system's value lies precisely in discovering new things, while defense mechanisms are inherently "trust only the known." There is a fundamental tension between safety and usefulness.
Why This Matters
This is not just a technical problem—it's an ecosystem problem. When AI recommendation systems become the primary gateway for consumer decisions, the trustworthiness of search results becomes the weak link in the entire trust chain. GEO operators have formed a black-market industry—they don't need to hack any system, just produce enough fake content online.
The paper's title says it plainly: One Polluted Page Is Enough. One fake review can flip the most advanced AI recommendation systems. And in the real world, attackers won't stop at one page—they'll post a hundred.
Paper: https://arxiv.org/abs/2606.13610 Code repository: https://github.com/leoluolol/forge-benchmark